Apache Shiro 1.2.4反序列化漏洞分析

PGRpdiBpZD0iY29udGVudHR4dCI+PGgyPjDDlzAwIEFwYWNoZSBTaGlybzwvaDI+PHA+6L+Z5Liq57uE5Lu255qE5ryP5rSe5b6I5LmF5LmL5YmN5bCx54iG5Ye65p2l5LqG77yM5L2G5piv5pyA6L+R5bel5L2c5Lit5Y+I6YGH5Yiw5LqG77yM5Yia5aW95pyA6L+R5Lmf5Zyo55yLSmF2YeWPjeW6j+WIl+WMlueahOS4nOilv++8jOaJgOS7peWGs+WumuaLv+WHuuadpeWGjeWIhuaekOS4gOS4i++8jOacn+mXtOS5n+mBh+WIsOS6huS4gOS6m+Wlh+aAqueahOmXrumimOOAgjwvcD48cD48YnIvPjwvcD48cD7nvZHkuIrnmoTliIbmnpDmlofnq6DkuK3lpKfpg6jliIbpg73mmK/miYvliqjmt7vliqDkuoZjb21tb25zLWNvbGxlY3Rpb25zNC00LjDnmoTkvp3otZbvvIznm67nmoTmmK/kuLrkuobkvb/nlKh5c29zZXJpYWznlJ/miJDnmoRDb21tb25zQ29sbGVjdGlvbnMy6L+Z5LiqcGF5bG9hZO+8jOeEtuiAjOaIkemBh+WIsOeahOaDheWGteaYr+S9v+eUqOS6hkNvbW1vbnNCZWFudXRpbHMx5bCx5Y+v5Lul55u05o6l5omT5oiQ5Yqf77yM5omA5Lul6L+Z6YeM5oiR5Lus5LiN5YaN6YeN5aSN572R5LiK5a+5Q29tbW9uc0NvbGxlY3Rpb25zMueahOWIhuaekOS6huOAgjwvcD48cD48YnIvPjwvcD48aDI+MMOXMDEg6LCD6K+V5YiG5p6QPC9oMj48cD7osIPor5Xnjq/looPvvJo8L3A+PHA+SkRLIDEuOC4wXzcyPC9wPjxwPlRvbWNhdCA4LjAuMzA8L3A+PHA+6aaW5YWI5oiR5Lus5oqKc2hpcm/nmoTmupDnoIFjbG9uZeWbnuadpe+8jOW5tuWIh+WIsOaciemXrumimOeahOWIhuaUr+S4iuWOu+OAgjwvcD48cHJlPjxjb2RlIGNsYXNzPSJobGpzIG5naW54Ij48c3BhbiBjbGFzcz0iaGxqcy1hdHRyaWJ1dGUiPmdpdDwvc3Bhbj4mbmJzcDtjbG9uZSZuYnNwO2h0dHBzOi8vZ2l0aHViLmNvbS9hcGFjaGUvc2hpcm8uZ2l0Jm5ic3A7c2hpcm8tcm9vdGNkJm5ic3A7c2hpcm8tcm9vdDxici8+Z2l0Jm5ic3A7Y2hlY2tvdXQmbmJzcDs8c3BhbiBjbGFzcz0iaGxqcy1udW1iZXIiPjE8L3NwYW4+LjxzcGFuIGNsYXNzPSJobGpzLW51bWJlciI+Mjwvc3Bhbj4uPHNwYW4gY2xhc3M9ImhsanMtbnVtYmVyIj4wPC9zcGFuPjxici8+PC9jb2RlPjwvcHJlPjxwPuS4uuS6huiDveiuqXNoaXJv6Ieq5bim55qEc2FtcGxl6LeR6LW35p2l77yM6KaB5a+5c2FtcGxlcy93ZWIvcG9tLnhtbOaWh+S7tuWBmuS4gOS6m+S/ruaUue+8jOmcgOimgeWwhmpzdGznmoTniYjmnKzmlLnkuLoxLjLvvIzlubbkuJTliKDmjolzZXJ2bGV0LWFwaeeahHNjb3Bl5a2X5q6144CC5ZCM5pe25bCGanN0bC0xLjIuamFy5pS+572u5ZyoV0VCLUlORi9saWLkuIvpnaLjgILnhLblkI7lupTor6XlsLHlj6/ku6Xot5HotbfmnaXlubbkuJTosIPor5XkuobjgII8L3A+PHA+PGJyLz48L3A+PHA+5oiR5Lus5bCG5pat54K55omT5Yiwb3JnLmFwYWNoZS5zaGlyby5tZ3QuRGVmYXVsdFNlY3VyaXR5TWFuYWdlcuS4reeahHJlc29sdmVQcmluY2lwYWxz5pa55rOV77yM5bm25LiU5Y+R6YCB5LiA5Liq5bim5pyJcmVtZW1iZXJNZSZuYnNwO0Nvb2tpZeeahOivt+axgu+8jOW6lOivpeWwseWPr+S7peaWreS4i+adpeS6huOAgjwvcD48cD48YSBocmVmPSJodHRwOi8vaW1hZ2UuMzAwMS5uZXQvaW1hZ2VzLzIwMTgwNzE5LzE1MzE5NzM4MTc3MDIucG5nIiBjbGFzcz0iaGlnaHNsaWRlLWltYWdlIiB0YXJnZXQ9Il9ibGFuayI+PGltZyBhbHQ9ImltYWdlLnBuZyIgc3JjPSJodHRwOi8vaW1hZ2UuMzAwMS5uZXQvaW1hZ2VzLzIwMTgwNzE5LzE1MzE5NzM4MTc3MDIucG5nIXNtYWxsIiBzdHlsZT0iZGlzcGxheTogYmxvY2s7IiB3aWR0aD0iNjkwIi8+PC9hPjwvcD48cD7miJHku6znu6fnu63ot5/ov5vov5nkuKpnZXRSZW1lbWJlcmVkSWRlbnRpdHnmlrnms5XvvJombmJzcDs8L3A+PHA+PGEgaHJlZj0iaHR0cDovL2ltYWdlLjMwMDEubmV0L2ltYWdlcy8yMDE4MDcxOS8xNTMxOTczODI5ODM4Mi5wbmciIGNsYXNzPSJoaWdoc2xpZGUtaW1hZ2UiIHRhcmdldD0iX2JsYW5rIj48aW1nIGFsdD0iaW1hZ2UucG5nIiBzcmM9Imh0dHA6Ly9pbWFnZS4zMDAxLm5ldC9pbWFnZXMvMjAxODA3MTkvMTUzMTk3MzgyOTgzODIucG5nIXNtYWxsIiBzdHlsZT0iZGlzcGxheTogYmxvY2s7IiB3aWR0aD0iNjkwIi8+PC9hPue7p+e7reS4gOebtOi3n+WIsGdldFJlbWVtYmVyZWRTZXJpYWxpemVkSWRlbnRpdHnmlrnms5XvvJombmJzcDs8L3A+PHA+PGEgaHJlZj0iaHR0cDovL2ltYWdlLjMwMDEubmV0L2ltYWdlcy8yMDE4MDcxOS8xNTMxOTczODQzNzYzNi5wbmciIGNsYXNzPSJoaWdoc2xpZGUtaW1hZ2UiIHRhcmdldD0iX2JsYW5rIj48aW1nIGFsdD0iaW1hZ2UucG5nIiBzcmM9Imh0dHA6Ly9pbWFnZS4zMDAxLm5ldC9pbWFnZXMvMjAxODA3MTkvMTUzMTk3Mzg0Mzc2MzYucG5nIXNtYWxsIiBzdHlsZT0iZGlzcGxheTogYmxvY2s7IiB3aWR0aD0iNjkwIi8+PC9hPuWcqOi/meS4quaWueazleS4re+8jOivu+WHuuS6huaIkeS7rOS8oOWFpeeahENvb2tpZe+8jOW5tuS4lOi/m+ihjOS6hmJhc2U2NOino+egge+8miZuYnNwOzwvcD48cD48YSBocmVmPSJodHRwOi8vaW1hZ2UuMzAwMS5uZXQvaW1hZ2VzLzIwMTgwNzE5LzE1MzE5NzM4NTYxODU4LnBuZyIgY2xhc3M9ImhpZ2hzbGlkZS1pbWFnZSIgdGFyZ2V0PSJfYmxhbmsiPjxpbWcgYWx0PSJpbWFnZS5wbmciIHNyYz0iaHR0cDovL2ltYWdlLjMwMDEubmV0L2ltYWdlcy8yMDE4MDcxOS8xNTMxOTczODU2MTg1OC5wbmchc21hbGwiIHN0eWxlPSJkaXNwbGF5OiBibG9jazsiIHdpZHRoPSI2OTAiLz48L2E+5o6l5LiL5p2lc2hpcm/kvJrosIPnlKhjb252ZXJ0Qnl0ZXNUb1ByaW5jaXBhbHPlubblsIZiYXNlNjTop6PnoIHlkI7nmoTlrZfoioLmlbDnu4TkvZzkuLrlj4LmlbDkvKDlhaXvvJo8L3A+PHA+PGEgaHJlZj0iaHR0cDovL2ltYWdlLjMwMDEubmV0L2ltYWdlcy8yMDE4MDcxOS8xNTMxOTczODc1Njc1OS5wbmciIGNsYXNzPSJoaWdoc2xpZGUtaW1hZ2UiIHRhcmdldD0iX2JsYW5rIj48aW1nIGFsdD0iaW1hZ2UucG5nIiBzcmM9Imh0dHA6Ly9pbWFnZS4zMDAxLm5ldC9pbWFnZXMvMjAxODA3MTkvMTUzMTk3Mzg3NTY3NTkucG5nIXNtYWxsIiBzdHlsZT0iZGlzcGxheTogYmxvY2s7IiB3aWR0aD0iNjkwIi8+PC9hPjwvcD48cD48YnIvPjwvcD48cD7ov5nph4zpgJrov4flh73mlbDlkI3kuZ/og73njJzlh7rmnaXvvIzov5vooYzkuobkuKTkuKrmk43kvZzvvIzliIbliKvmmK/op6Plr4blkozlj43luo/liJfljJbvvIzmiJHku6zlhYjmnaXnnIvop6Plr4bpg6jliIbvvIznu4/ov4fnroDljZXnmoTosIPor5XlkI7vvIzlj5HnjrDmmK/kuIDkuKpBRVPop6Plr4bvvIzlubbkuJTlrZjlnKjkuIDkuKrpooTorr7np5jpkqVCYXNlNjQuZGVjb2RlKOKAnGtQSCtiSXhrNUQyZGVaaUl4Y2FhYUE9PeKAnSk777yM5Zyoc2hpcm/oh6rluKbnmoRzYW1wbGXkuK3vvIzlubbmsqHmnInpgJrov4flhbbku5bnmoTmlrnlvI/orr7nva7ov5nkuKrnp5jpkqXvvIzmiYDku6Xov5nph4znlKjnmoTlsLHmmK/ov5nkuKrpooTorr7lgLzjgII8L3A+PHA+6ICMQUVT6Kej5a+G5Lit6YGH5Yiw55qESVbkuZ/mmK/ku47miJHku6zkvKDlhaXnmoRDb29raWXkuK3nmoTliY3lh6DkuKrlrZfoioLkuK3ojrflj5bnmoTvvIzkuo7mmK/miJHku6zlj6/ku6XovbvmmJPnmoTmnoTpgKDlh7rljIXlkKvku7vmhI/lhoXlrrnnmoRDb29raWXlgLzvvIzop6Plr4blpb3nmoTmmI7mloflsLHmmK/luo/liJfljJbnmoTlhoXlrrnvvIzosIPnlKjkuoZkZXNlcmlhbGl6Zei/m+ihjOWPjeW6j+WIl+WMluOAgjwvcD48cD7mnIDnu4jkvJrosIPnlKjliLBvcmcuYXBhY2hlLnNoaXJvLmlvLkRlZmF1bHRTZXJpYWxpemVyI2Rlc2VyaWFsaXpl5pa55rOV6L+b6KGM5Y+N5bqP5YiX5YyW77yaICZuYnNwOyAmbmJzcDs8YnIvPjxhIGhyZWY9Imh0dHA6Ly9pbWFnZS4zMDAxLm5ldC9pbWFnZXMvMjAxODA3MTkvMTUzMTk3Mzg5NjU3MTcucG5nIiBjbGFzcz0iaGlnaHNsaWRlLWltYWdlIiB0YXJnZXQ9Il9ibGFuayI+PGltZyBhbHQ9ImltYWdlLnBuZyIgc3JjPSJodHRwOi8vaW1hZ2UuMzAwMS5uZXQvaW1hZ2VzLzIwMTgwNzE5LzE1MzE5NzM4OTY1NzE3LnBuZyFzbWFsbCIgc3R5bGU9ImRpc3BsYXk6IGJsb2NrOyIgd2lkdGg9IjY5MCIvPjwvYT48L3A+PHA+5pW05Liq5rWB56iL5Y2B5YiG566A5Y2V77yM566A6KaB5qaC5ous5LiA5LiL5bCx5piv77ya6K+75Y+WY29va2llIC0+IGJhc2U2NOino+eggSAtPiBBRVPop6Plr4YgLT4g5Y+N5bqP5YiX5YyWPC9wPjxwPuaJgOS7peaIkeS7rOeahHBheWxvYWTmnoTpgKDotbfmnaXkuZ/mmK/ljYHliIbnmoTnroDljZXvvIzlrozmlbTnmoRQb0PmiJHkvJrmlL7liLBHaXRodWLjgII8L3A+PHA+PGJyLz48L3A+PGgyPjDDlzAyIOeWkeeCueino+aDkTwvaDI+PHA+5Zyo6LCD6K+V55qE6L+H56iL5Lit77yM6YGH5Yiw5LqG5LiA5Lqb6Zeu6aKY77yM5bm25rKh5pyJ5oiQ5Yqf55qE5by55Ye66K6h566X5Zmo77yM6L+Z6YeM6K6w5b2V5LiA5LiL44CCPC9wPjxoMz4xLiDkuLrku4DkuYjmnKzlnLDmkK3lu7rnjq/looPvvIzkvb/nlKhDb21tb25zQmVhbnV0aWxzMeaJk+S4jeaIkOWKn++8jOaAu+aYr+aPkOekukNsYXNzTm90Rm91bmTlvILluLjvvJ88L2gzPjxwPui/meS4qumXrumimOaIkeW9k+aXtuiwg+ivleS6huWlveS5he+8jOS4gOW6puS7peS4uuaYr3BheWxvYWTmnInpl67popjmiJbogIVzaGlyb+eahOS7o+eggeWboOS4uuW5tOS7o+S5hei/nOacieS6huWPmOWMlu+8jOWboOS4uuW9k+aXtumBh+WIsOeahGNhc2XlsLHmmK/ov5nkuKpwYXlsb2Fk5LiA5Y+R5YWl6a2C55qE77yM6KGo56S65Y2B5YiG55qE6L+36Iyr44CC5ZCO5p2l5Y+R546w5LqG5YWz6ZSu6Zeu6aKY77yM5oiR5Lus5LuOZ2l0aHVi5LiKY2xvbmXliLDnmoRzYW1wbGXkuK3vvIxjb21tb25zLWJlYW51dGlsc+i/meS4quS+nei1lueahOeJiOacrOaYrzEuOC4z77yM6ICMeXNvc2VyaWFs55Sf5oiQ55qEcGF5bG9hZOeahOeJiOacrOaYrzEuOS4y77yM5omA5Lul5Zyo6buY6K6k55qEc2FtcGxl5Lit5piv5peg5rOV5omT5oiQ5Yqf55qE44CC5LqO5piv5oiR5L+u5pS554mI5pys5Y+35YiwMS45LjLvvIzkuIDlj5HlhaXprYLjgII8L3A+PHA+5omA5Lul6YGH5Yiw55qE6YKj5Liq5qGI5L6L5Lit77yM5a6e6ZmF55qE5L6d6LWW546v5aKD54mI5pys5Y+v6IO95Lmf5piv6L+Z5qC355qE5ZCn77yM5omA5Lul5omN6IO955u05o6l5omT5oiQ5Yqf44CCPC9wPjxoMz4yLiDlgYflpoLmiJHnmoTkvp3otZbkuK3lsLHmmK/msqHmnInpq5jniYjmnKznmoRjb21tb25zLWJlYW51dGlsc+WSjGNvbW1vbnMtY29sbGVjdGlvbnPkuYvnsbvnmoTljIXvvIzmgI7kuYjliKnnlKjvvJ88L2gzPjxwPui/meS4qumhueebrmNsb25l5LiL5p2l5LmL5ZCO77yM5Y+v5Lul55yL5Yiw5piv5a2Y5Zyo5LiA5LiqY29tbW9ucy1jb2xsZWN0aW9uc+eahOWMheeahO+8miZuYnNwOzwvcD48cD48YSBocmVmPSJodHRwOi8vaW1hZ2UuMzAwMS5uZXQvaW1hZ2VzLzIwMTgwNzE5LzE1MzE5NzM5Mjc0ODY3LnBuZyIgY2xhc3M9ImhpZ2hzbGlkZS1pbWFnZSIgdGFyZ2V0PSJfYmxhbmsiPjxpbWcgYWx0PSJpbWFnZS5wbmciIHNyYz0iaHR0cDovL2ltYWdlLjMwMDEubmV0L2ltYWdlcy8yMDE4MDcxOS8xNTMxOTczOTI3NDg2Ny5wbmchc21hbGwiIHN0eWxlPSJkaXNwbGF5OiBibG9jazsiIHdpZHRoPSI0NDUiLz48L2E+PC9wPjxwPuS9huaYr+S9v+eUqHlzb3NlcmlhbOaPkOS+m+eahENvbW1vbnNDb2xsZWN0aW9uczHmmK/ml6Dms5XmiJDlip/nmoTvvIzkvJrniIblh7rkuIDkuKrlvILluLjvvJo8L3A+PHA+PGEgaHJlZj0iaHR0cDovL2ltYWdlLjMwMDEubmV0L2ltYWdlcy8yMDE4MDcxOS8xNTMxOTczOTM5NjE4Ni5wbmciIGNsYXNzPSJoaWdoc2xpZGUtaW1hZ2UiIHRhcmdldD0iX2JsYW5rIj48aW1nIGFsdD0iaW1hZ2UucG5nIiBzcmM9Imh0dHA6Ly9pbWFnZS4zMDAxLm5ldC9pbWFnZXMvMjAxODA3MTkvMTUzMTk3MzkzOTYxODYucG5nIXNtYWxsIiBzdHlsZT0iZGlzcGxheTogYmxvY2s7IiB3aWR0aD0iNjkwIi8+PC9hPui/meWwseWNgeWIhueahOWlh+aAquS6hu+8jOS4uuS7gOS5iOWBj+WBj+aXoOazleWPjeW6j+WIl+WMlmJ5dGUgYXJyYXnnsbvlnovvvIzosIPor5XkuobkuIDkuIvlj5HnjrDmmK/lnKjov5nph4zmipvlh7rnmoTlvILluLjvvJo8L3A+PHA+PGEgaHJlZj0iaHR0cDovL2ltYWdlLjMwMDEubmV0L2ltYWdlcy8yMDE4MDcxOS8xNTMxOTczOTUzMjc0MC5wbmciIGNsYXNzPSJoaWdoc2xpZGUtaW1hZ2UiIHRhcmdldD0iX2JsYW5rIj48aW1nIGFsdD0iaW1hZ2UucG5nIiBzcmM9Imh0dHA6Ly9pbWFnZS4zMDAxLm5ldC9pbWFnZXMvMjAxODA3MTkvMTUzMTk3Mzk1MzI3NDAucG5nIXNtYWxsIiBzdHlsZT0iZGlzcGxheTogYmxvY2s7IiB3aWR0aD0iNjkwIi8+PC9hPjwvcD48cD7mn6XkuobkuIDkuItKYXZh5LitQ2xhc3MuZm9yTmFtZSgp5Lul5Y+KQ2xhc3NMb2FkZXIubG9hZENsYXNzKCnnmoTljLrliKvvvIzlj5HnjrBmb3JOYW1lKCnmgLvmmK/kvb/nlKjosIPnlKjogIXnmoRDbGFzc0xvYWRlcigp77yM6ICMbG9hZENsYXNzKCnliJnmmK/lj6/ku6Xoh6rlt7HmjIflrprkuIDkuKrkuI3lkIznmoRDbGFzc0xvYWRlcuOAgumCo3NoaXJv5Lit55qEQ2xhc3NzTG9hZGVy5piv5oCO5LmI5p2l55qE77yf5piv6YCa6L+HVGhyZWFkLmN1cnJlbnRUaHJlYWQoKS5nZXRDb250ZXh0Q2xhc3NMb2FkZXIoKTvojrflj5bnmoTvvIzkuZ/lsLHmmK9XZWJhcHBDbGFzc0xvYWRlcuOAguS9huaYr+S4uuWVpeaPkOekuuaXoOazleWKoOi9vWJ5dGUKIGFycmF55ZGi77yM5pCc57Si5LqG5LiA55Wq55yL5Yiw5LqGb3Jhbmdl5Y2a5a6i5LiL6Z2i55qE6K6o6K6677yM5LqG6Kej5Yiw5LqG5pW05Liq5LqL5oOF55qE55yf55u477yaPC9wPjxwPlNoaXJvIHJlc292bGVDbGFzc+S9v+eUqOeahOaYr0NsYXNzTG9hZGVyLmxvYWRDbGFzcygp6ICM6Z2eQ2xhc3MuZm9yTmFtZSgp77yM6ICMQ2xhc3NMb2FkZXIubG9hZENsYXNz5LiN5pSv5oyB6KOF6L295pWw57uE57G75Z6L55qEY2xhc3PjgII8L3A+PHA+5YW35L2T55qE5YaF5a655oiR5Zyo6L+Z6YeM5bCx5LiN5bGV5byA6K6o6K665LqG77yM6K+m5oOF5Y+v5Y+C6ICD5paH5pyr5Y6f5L2c6ICF55qE6ZO+5o6l44CC5ZCE5L2N5ZCM5a2m5Y+v5Lul5Y6756CU56m25LiA5LiL77yM5YyF5ous5Zyo5L2O54mI5pys5LiL5Y+N5by5c2hlbGznmoTmlrnms5XvvIzlnKhvcmFuZ2XnmoTljZrlrqLkuK3kuZ/mnInorrLliLDjgII8L3A+PGJyLz48cD4q5pys5paH5L2c6ICF77ya576O5Li96IGU5ZCI5a6J5YWoTUxTUkPvvIzovazovb3oh6pGcmVlQnVmPC9wPjwvZGl2Pg==